Everyday devices are used to hide ongoing account compromise campaign

Everyday devices are used to hide ongoing account compromise campaign

Briefly

The net sum of this activity is that most of the traffic in these credential-stuffing attacks appears to originate from the mobile devices and browsers of everyday users, rather than from the IP space of VPS providers.

Ars Technicahttps://arstechnica.com/security/2024/04/everyday-devices-are-used-to-hide-ongoing-account-compromise-campaign/

Unidentified adversaries use devices of everyday users for credential-stuffing attacks, obtained from data breaches, leveraging TOR network, proxy services, and malicious apps.

Ars Technicahttps://arstechnica.com/security/2024/04/everyday-devices-are-used-to-hide-ongoing-account-compromise-campaign/